build(deps): bump the npm-minor-patch group across 1 directory with 7 updates by dependabot[bot] · Pull Request #48 · fly1d/wordwise

dependabot · 2026-09-01T11:28:30Z

Bumps the npm-minor-patch group with 7 updates in the / directory:

Package	From	To
express-rate-limit	`8.6.2`	`8.7.0`
lucide-react	`1.31.0`	`1.37.0`
mammoth	`1.12.1`	`1.12.2`
multer	`2.2.0`	`2.3.0`
@types/node	`26.2.0`	`26.4.0`
@types/react-dom	`19.2.4`	`19.2.5`
vitest	`4.1.10`	`4.1.11`

Updates express-rate-limit from 8.6.2 to 8.7.0

Release notes

Sourced from express-rate-limit's releases.

v8.7.0

You can view the changelog here.

Commits

48db09e 8.7.0
dce5871 v8.7.0 changelog
2f08044 Add inspect.software health badge (#673)
a29757c feat: add retryAfter option (#661)
146e88b chore: rename license
5cfb8e8 ci: drop top-level id-token: write from the workflow token (#676)
062bbdd fix: re-wrap license.md so GitHub recognizes it as MIT (#675)
514772d chore(deps-dev): bump mintlify in the development-dependencies group (#674)
4f06c8a chore(deps-dev): bump the development-dependencies group with 2 updates (#671)
83356a5 chore(deps): bump ip-address from 10.4.0 to 10.5.0 (#672)
Additional commits viewable in compare view

Updates lucide-react from 1.31.0 to 1.37.0

Release notes

Sourced from lucide-react's releases.

Version 1.37.0

What's Changed

feat(icons): added 'robot-vacuum' icon by @benhaube in lucide-icons/lucide#4599

feat(icons): made face-angry even more angry by @karsa-mistmere in lucide-icons/lucide#4708

fix(icons): changed swords icon by @jguddas in lucide-icons/lucide#4707

fix(icons): changed shopping-cart icon by @jguddas in lucide-icons/lucide#2909

docs(icon-description): added old and empty tags/use case for ghost by @TFJ5183 in lucide-icons/lucide#4762

feat(icons): add playing-card, playing-cards, and playing-cards-fan by @Barakudum in lucide-icons/lucide#4258

fix(icons): changed beef icon by @jguddas in lucide-icons/lucide#3457

chore(tags): added music disc related tags to circle-dot by @jguddas in lucide-icons/lucide#3909

fix(icons): changed panda icon by @jguddas in lucide-icons/lucide#3187

fix(icons): rotate blend icon by @jguddas in lucide-icons/lucide#3105

fix(icons): rotate key icon by @jguddas in lucide-icons/lucide#3111

fix(icons): changed square-split-vertical icon by @jguddas in lucide-icons/lucide#3939

fix(icons): changed asterisk icon by @jguddas in lucide-icons/lucide#3906

fix(icons): unify check, cross and plus sizes across icons by @karsa-mistmere in lucide-icons/lucide#3875

feat(icons): added message-circle-dashed-check icon by @aliyasirnac in lucide-icons/lucide#3678

fix(icons): changed piano icon by @karsa-mistmere in lucide-icons/lucide#4766

feat(icons): added credit-card-x & credit-card-check icon by @karsa-mistmere in lucide-icons/lucide#4763

feat(icons): added credit-card-minus icon by @ameniti-mx in lucide-icons/lucide#4440

feat(icons): added credit-card-plus icon by @ameniti-mx in lucide-icons/lucide#4441

New Contributors

@benhaube made their first contribution in lucide-icons/lucide#4599

@TFJ5183 made their first contribution in lucide-icons/lucide#4762

@aliyasirnac made their first contribution in lucide-icons/lucide#3678

@ameniti-mx made their first contribution in lucide-icons/lucide#4440

Full Changelog: lucide-icons/lucide@1.35.0...1.37.0

Version 1.36.0

What's Changed

feat(icons): added 'robot-vacuum' icon by @benhaube in lucide-icons/lucide#4599

feat(icons): made face-angry even more angry by @karsa-mistmere in lucide-icons/lucide#4708

fix(icons): changed swords icon by @jguddas in lucide-icons/lucide#4707

fix(icons): changed shopping-cart icon by @jguddas in lucide-icons/lucide#2909

docs(icon-description): added old and empty tags/use case for ghost by @TFJ5183 in lucide-icons/lucide#4762

feat(icons): add playing-card, playing-cards, and playing-cards-fan by @Barakudum in lucide-icons/lucide#4258

fix(icons): changed beef icon by @jguddas in lucide-icons/lucide#3457

chore(tags): added music disc related tags to circle-dot by @jguddas in lucide-icons/lucide#3909

fix(icons): changed panda icon by @jguddas in lucide-icons/lucide#3187

fix(icons): rotate blend icon by @jguddas in lucide-icons/lucide#3105

fix(icons): rotate key icon by @jguddas in lucide-icons/lucide#3111

fix(icons): changed square-split-vertical icon by @jguddas in lucide-icons/lucide#3939

fix(icons): changed asterisk icon by @jguddas in lucide-icons/lucide#3906

fix(icons): unify check, cross and plus sizes across icons by @karsa-mistmere in lucide-icons/lucide#3875

feat(icons): added message-circle-dashed-check icon by @aliyasirnac in lucide-icons/lucide#3678

fix(icons): changed piano icon by @karsa-mistmere in lucide-icons/lucide#4766

feat(icons): added credit-card-x & credit-card-check icon by @karsa-mistmere in lucide-icons/lucide#4763

feat(icons): added credit-card-minus icon by @ameniti-mx in lucide-icons/lucide#4440

... (truncated)

Commits

75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
See full diff in compare view

Updates mammoth from 1.12.1 to 1.12.2

Changelog

Sourced from mammoth's changelog.

1.12.2

Avoid prototype pollution when reading the styles defined in a document. This avoids an issue where a maliciously crafted document could be used to set externalFileAccess to true.

Commits

8706034 Bump version to 1.12.2
2888fa1 Create objects without prototypes when used as map with arbitrary keys
31f0c37 Avoid prototype pollution when reading styles
See full diff in compare view

Updates multer from 2.2.0 to 2.3.0

Release notes

Sourced from multer's releases.

v2.3.0

Important

Fix CVE-2026-77078 (GHSA-wc9g-mqfw-jrwm)

Fix CVE-2026-77037 (GHSA-qfvm-cv95-jqjf)

Fix CVE-2026-77063 (GHSA-qvfw-j98x-7q72)

Fix CVE-2026-82333 (GHSA-535w-7cp7-47q4)

What's Changed

Update busboy link pointing to nonexistent section by @krzysdz in expressjs/multer#1447

Update outdated links to Express error handling guide by @krzysdz in expressjs/multer#1405

chore(deps): bump GitHub Actions and dev dependencies by @sheplu in expressjs/multer#1445

chore(ci): npm-publish via reusable workflows by @sheplu in expressjs/multer#1364

fix(tests): keep Git from rewriting fixture line endings on Windows by @MohammedAlkindi in expressjs/multer#1450

docs: correct fieldNameSize default in limits table by @UlisesGascon in expressjs/multer#1432

feat: normalize package.json by @UlisesGascon in expressjs/multer#1322

fix(test): use path.sep for cross-platform path assertions by @kilisamemarisaaa in expressjs/multer#1452

docs(changelog): fix typo 'comaptible' to 'compatible' by @ayushshukla1807 in expressjs/multer#1383

doc: adds context for link to Chinese README by @sunsheeppoplar in expressjs/multer#1369

docs: use crypto.randomBytes in diskStorage README example by @Hashim1999164 in expressjs/multer#1436

docs: clarify preservePath behavior by @vibhor-aggr in expressjs/multer#1414

docs: clarify parts limit behavior by @vibhor-aggr in expressjs/multer#1430

chore: increase test coverage by @wojtekmaj in expressjs/multer#1355

chore: drop deep-equal devDependency by @wojtekmaj in expressjs/multer#1353

docs: fix Chinese README translation by @vibhor-aggr in expressjs/multer#1429

Test: Enhance cross-platform test reliability and update CI workflow by @ShubhamOulkar in expressjs/multer#1334

fix: fallback to error code when no message mapping exists by @sahilraut191685 in expressjs/multer#1448

test: add coverage for preservePath by @kory-kaai in expressjs/multer#1454

fix: prevent process crash when fileFilter calls its callback more than once by @spokodev in expressjs/multer#1427

fix: preserve async hooks context in supported environments by @ajhyndman in expressjs/multer#1124

fix: allow files at exact fileSize limit by @raashish1601 in expressjs/multer#1407

fix: decode WHATWG-escaped characters in file originalname by @webdevelopersrinu in expressjs/multer#1421

docs: add Indonesian translation for README by @Derylfabiensyah in expressjs/multer#1431

test: accept files exactly at fileSize limit by @abhu85 in expressjs/multer#1382

docs: add Japanese translation to README by @noritaka1166 in expressjs/multer#1354

Update 'README-zh-cn.md' up to now by @pbstar in expressjs/multer#1264

feat: add an opt-in fieldArrayIndexLimit by @arpitjain099 in expressjs/multer#1438

docs: refresh all README translations by @UlisesGascon in expressjs/multer#1462

2.3.0 by @UlisesGascon in expressjs/multer#1455

New Contributors

@krzysdz made their first contribution in expressjs/multer#1447

@sheplu made their first contribution in expressjs/multer#1445

@MohammedAlkindi made their first contribution in expressjs/multer#1450

@kilisamemarisaaa made their first contribution in expressjs/multer#1452

@ayushshukla1807 made their first contribution in expressjs/multer#1383

@sunsheeppoplar made their first contribution in expressjs/multer#1369

@Hashim1999164 made their first contribution in expressjs/multer#1436

@vibhor-aggr made their first contribution in expressjs/multer#1414

@sahilraut191685 made their first contribution in expressjs/multer#1448

... (truncated)

Changelog

Sourced from multer's changelog.

2.3.0

Fix CVE-2026-77078 (GHSA-wc9g-mqfw-jrwm)

Fix CVE-2026-77037 (GHSA-qfvm-cv95-jqjf)

Fix CVE-2026-77063 (GHSA-qvfw-j98x-7q72)

Fix CVE-2026-82333 (GHSA-535w-7cp7-47q4)

Add MulterError codes INVALID_FIELD_NAME and STREAM_DESTROYED

Add opt-in limits.fieldArrayIndexLimit to bound numeric array indexes in field names (#1438)

Accept files whose size is exactly limits.fileSize (#1407)

Preserve the caller's async context (AsyncLocalStorage) when calling next() (#1124)

Decode WHATWG-escaped characters (%0A, %0D, %22) in file.originalname (#1421)

Do not crash when fileFilter invokes its callback more than once (#1427)

Use a fallback message for MulterError codes without a mapping (#1448)

Docs: clarify preservePath and parts, use crypto.randomBytes in the DiskStorage example (#1414, #1430, #1436)

Docs: add Indonesian, Japanese and Tamil translations and refresh all translations from the current README (#1431, #1354, #1462)

Internal: run the test suite on Windows (#1334)

Commits

4e8edf5 2.3.0 (#1455)
87a584e fix: reject invalid field names instead of crashing on append-field errors
ab6aeae fix: enforce file size limit with async fileFilter
eef7444 fix: destroy disk write stream on aborted uploads to prevent fd leak
25ec9bb docs: refresh all README translations (#1462)
73c1759 feat: add an opt-in fieldArrayIndexLimit (#1438)
ece6735 Update 'README-zh-cn.md' up to now (#1264)
3278e1b docs: add Japanese translation to README (#1354)
3c0bc5e test: accept files exactly at fileSize limit (#1382)
b6d84b0 docs: add Indonesian translation for README (#1431)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for multer since your current version.

Updates @types/node from 26.2.0 to 26.4.0

Commits

See full diff in compare view

Updates @types/react-dom from 19.2.4 to 19.2.5

Commits

See full diff in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

View changes on GitHub

Commits

9bd8d46 chore: release v4.1.11 (#10995)
9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… updates Bumps the npm-minor-patch group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.6.2` | `8.7.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.37.0` | | [mammoth](https://github.com/mwilliamson/mammoth.js) | `1.12.1` | `1.12.2` | | [multer](https://github.com/expressjs/multer) | `2.2.0` | `2.3.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.4.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.5` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` | Updates `express-rate-limit` from 8.6.2 to 8.7.0 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v8.6.2...v8.7.0) Updates `lucide-react` from 1.31.0 to 1.37.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.37.0/packages/lucide-react) Updates `mammoth` from 1.12.1 to 1.12.2 - [Release notes](https://github.com/mwilliamson/mammoth.js/releases) - [Changelog](https://github.com/mwilliamson/mammoth.js/blob/master/NEWS) - [Commits](mwilliamson/mammoth.js@1.12.1...1.12.2) Updates `multer` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/expressjs/multer/releases) - [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md) - [Commits](expressjs/multer@v2.2.0...v2.3.0) Updates `@types/node` from 26.2.0 to 26.4.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/react-dom` from 19.2.4 to 19.2.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `vitest` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: express-rate-limit dependency-version: 8.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: lucide-react dependency-version: 1.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: mammoth dependency-version: 1.12.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: multer dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@types/node" dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@types/react-dom" dependency-version: 19.2.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026

Navigation Menu

build(deps): bump the npm-minor-patch group across 1 directory with 7 updates - #48

build(deps): bump the npm-minor-patch group across 1 directory with 7 updates#48
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-90a1f9278d

dependabot Bot commented on behalf of github Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 1, 2026

v8.7.0

Version 1.37.0

What's Changed

New Contributors

Version 1.36.0

What's Changed

1.12.2

v2.3.0

Important

What's Changed

New Contributors

2.3.0

v4.1.11

🐞 Bug Fixes

View changes on GitHub

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants